When you buy a TV streaming box, there are certain things you wouldn’t expect it to do. It shouldn’t secretly be laced with malware or start communicating with servers in China when it’s powered up.

That cheap streaming box promising free movies, live sports and premium channels may come with a hidden cost you never agreed to pay. Security researchers are warning about a sprawling Android-based ...